Reviewing Access Requests for Specific Groups

[pnrao1983]

Overview

In specific scenarios, it is crucial to manage resource access requests so that reviewers can only review and approve requests originating from a particular group(s). In this scenario, we'll explore a unique use case where multiple teams or groups share the same requester role, but reviewers want to be able to review and approve requests only from their specific group.

Scenario

• Multiple teams have the same role assigned to request access to a resource(s).
• The reviewer wants to review and approve requests initiated only by their specific group (e.g., Customer-Success-Team).

Solution

We can leverage the where statement with the request.system_annotations field to address this unique use case. For more details, review the Request Annotations documentation.

where: contains(request.system_annotations["groups"], "Customer-Success-Team")

Role Definitions:

Requester Role
This role allows users to request access while including their group information in the annotations.

kind: role
metadata:
  name: test-requester
spec:
  allow:
    review_requests:
      claims_to_roles:
      - claim: groups
        roles:
        - '*'
        value: Customer-Success-Team
      where: contains(request.system_annotations["groups"], "Customer-Success-Team")

Reviewer Role
This role is configured to allow reviewers to see and approve requests only if they come from users who are members of the group Customer-Success-Team.

kind: role
metadata:
  name: test-reviewer
spec:
  allow:
    request:
      annotations:
        groups:
        - '{{external.groups}}'
        - foobar
      search_as_roles:
      - access
      thresholds:
      - approve: 1
        deny: 1

This configuration ensures that the approver can only review requests from users in the Customer-Success-Team group. The where condition checks if the group's system annotation contains Customer-Success-Team.

Summary
By implementing this approach, you can ensure that reviewers only see and manage requests relevant to them while effectively managing access requests within specific groups.

Reference: access-control

Note
If using AzureAD as IDP, ensure the group value is represented by the Group ID and not Group Name